Sunday, December 16, 2012

Security Onion 12.04 RC1 Available Now!

Introduction

What is Security Onion?

Security Onion is a network security monitoring system that provides full context and forensic visibility into the traffic it monitors. At it's heart it is designed to make deploying multiple complex open source tools simple via a single package, reducing what would normally take days to weeks of work to minutes. Featuring Bro IDS, your choice of Snort or Suricata, Sguil analyst console, ELSA, Squert, Snorby and capME web interfaces, and the ability to pivot from one tool to the next seamlessly provides the most effective collection of network security tools available in a single package.

What can it do for you?

Context - Bro IDS provides visibility into the haystack, while signature-based detection targets the needle. Now you can know not only what signature-based events occurred, but you can have full context of all activity detected from the host involved. What domains a host queries, SSL certificates it's used, files downloaded, FTP/SMTP/IRC activity? All contextual questions that can help determine whether a signature-based alert is an event or an incident.

Evidence - Full packet capture means you can know exactly what a host did. Sguil and its integration with other tools in Security Onion, such as Network Miner and Wireshark in addition to ELSA, Squert and Snorby via capME, allow an analyst to look at the evidence of a network attack frame by frame exactly as it happened, all with a click of a mouse.

Tools - Security Onion is loaded with tools to monitor your network efficiently and effectively. Sguil provides the best security analyst console available in terms of function and utility. Squert and Snorby provide visibility into Sguil and Snort respectively, and ELSA provides a Splunk-like interface to the vast wealth of log data Security Onion will harvest from Bro, OSSEC and more.

Save Money - It's free, well except for the hardware. But it will help you save a lot of money you might otherwise throw at commercial solutions and you could maybe spend some of that money so your analysts can become better.

What can't it do for you?

Security Onion is a network monitoring and detection system. It will not block an attack, nor is it designed to. It will however act as a video camera for your network for every connection it sees, not just the one's that it thinks are bad. In a world where detection rates are unpredictable, evidence like this can save you a lot of money.

Instructions

Screenshots

The following screenshot starts out with a typical IDS alert in Snorby. Wanting to investigate further, we click "Packet Capture Options" and then "Custom" which results in the "Packet Capture Builder" popup window. Clicking "Fetch Packet" will result in a CapME query to display the transcript of the entire conversation as shown in the final screenshot.

Pivoting from Snorby to CapME pcap transcript

In the following screenshot, we've queried ELSA for Bro notices of type "HTTP::Malware_Hash_Registry_Match". (Did you know that Bro automatically creates an MD5 sum of every file it sees transferred over HTTP and compares those MD5 sums to Team Cymru's Malware Hash Registry?) After finding some matches, we click the "Info" link on the left which results in an Info popup window. Here we click the Plugin dropdown box and select "getPcap" to send a request to CapME as shown in the final screenshot.

Thanks

Thanks to everyone who has helped us get this far! Thanks to all of our testers for finding and reporting issues and HUGE thanks to the following for their tireless efforts over the last few weeks on building CapME and getting it fully integrated:Paul HallidayMartin HolsteScott Runnels

Security Onion

Security Onion is a Linux distro for intrusion detection, network security monitoring, and log management. It's based on Ubuntu and contains Snort, Suricata, Bro, OSSEC, Sguil, Squert, ELSA, Xplico, NetworkMiner, and many other security tools. The easy-to-use Setup wizard allows you to build an army of distributed sensors for your enterprise in minutes!